arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/trello.md

@@ -0,0 +1,139 @@
+# Trello Export Quick Guide
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+Export your ArcKit product backlog to a Trello board with `/arckit:trello`. The command reads the JSON output from `/arckit:backlog FORMAT=json` and creates a fully structured board with sprint lists, labelled cards, and acceptance criteria checklists.
+
+---
+
+## Prerequisites
+
+| Requirement | How to get it |
+|-------------|---------------|
+| Backlog JSON file (`ARC-*-BKLG-*.json`) | Run `/arckit:backlog FORMAT=json` |
+| `TRELLO_API_KEY` environment variable | [Trello Power-Ups Admin](https://trello.com/power-ups/admin) — create or select a Power-Up, copy the API key |
+| `TRELLO_TOKEN` environment variable | Visit `https://trello.com/1/authorize?expiration=30days&scope=read,write&response_type=token&key=YOUR_API_KEY` and copy the token |
+
+Set credentials in your shell:
+
+```bash
+export TRELLO_API_KEY="your-api-key-here"
+export TRELLO_TOKEN="your-token-here"
+```
+
+---
+
+## Command Patterns
+
+```bash
+/arckit:trello                                    # default board name from project
+/arckit:trello BOARD_NAME="Q1 Sprint Board"       # custom board name
+/arckit:trello WORKSPACE_ID="60f1a2b3c4d5e6f7"    # create in specific workspace
+```
+
+---
+
+## Board Structure
+
+```text
+Board: "{Project Name} - Sprint Backlog"
+├── List: "Product Backlog"        ← unscheduled/overflow items
+├── List: "Sprint 1: Foundation"   ← stories assigned to sprint 1
+├── List: "Sprint 2: Core"        ← stories assigned to sprint 2
+├── ...                            ← one list per planned sprint
+├── List: "In Progress"
+└── List: "Done"
+```
+
+---
+
+## Card Format
+
+| Field | Example |
+|-------|---------|
+| **Name** | `STORY-001: Create user account [8pts]` |
+| **Description** | GDS user story format + metadata |
+| **Labels** | `Must Have` (red) + `Story` (blue) |
+| **Checklist** | Acceptance criteria as check items |
+
+**Card description example**:
+
+```text
+**As a** new user
+**I want** to create an account
+**So that** I can access the service
+
+**Story Points**: 8
+**Priority**: Must Have
+**Component**: User Service
+**Requirements**: FR-001, NFR-008, NFR-012
+**Epic**: EPIC-001 - User Management
+**Dependencies**: None
+```
+
+---
+
+## Labels
+
+| Label | Colour | Purpose |
+|-------|--------|---------|
+| Must Have | Red | MoSCoW priority |
+| Should Have | Orange | MoSCoW priority |
+| Could Have | Yellow | MoSCoW priority |
+| Epic | Purple | Item type |
+| Story | Blue | Item type |
+| Task | Green | Item type |
+
+---
+
+## Workflow
+
+| Stage | Action |
+|-------|--------|
+| 1. Generate backlog | `/arckit:backlog FORMAT=json` (or `FORMAT=all` for markdown + CSV + JSON) |
+| 2. Set credentials | Export `TRELLO_API_KEY` and `TRELLO_TOKEN` |
+| 3. Run export | `/arckit:trello` |
+| 4. Review board | Open the returned Trello URL |
+| 5. Invite team | Add team members to the board in Trello |
+| 6. Start sprints | Drag cards from sprint lists to "In Progress" as work begins |
+
+---
+
+## Rate Limits
+
+Trello allows **100 requests per 10-second window** per API token. The command adds a small delay between API calls to stay within limits. For large backlogs (80+ stories), expect the export to take a couple of minutes.
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| `unauthorized` error | Token may have expired — generate a new one with the authorize URL |
+| `invalid key` error | Check `TRELLO_API_KEY` is set correctly |
+| `board not found` after creation | Trello API may be slow — wait a moment and check your boards list |
+| Rate limit (429) errors | Re-run the command; it will create a new board for remaining items |
+| Wrong workspace | Specify `WORKSPACE_ID` to target the correct organization |
+
+---
+
+## Re-exporting
+
+This command always creates a **new board**. To re-export:
+
+1. Delete or archive the old board in Trello
+2. Re-run `/arckit:trello`
+
+Or use a different board name:
+
+```bash
+/arckit:trello BOARD_NAME="Sprint Board v2"
+```
+
+---
+
+## Useful References
+
+- [Trello REST API documentation](https://developer.atlassian.com/cloud/trello/rest/)
+- `/arckit:backlog` to generate the source JSON
+- `/arckit:traceability` to verify requirements coverage before export

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-ai-autonomy-tier.md

@@ -0,0 +1,84 @@
+# UAE AI Autonomy Tier Posture Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-ai-autonomy-tier` generates a three-tier AI Autonomy Posture for a UAE federal entity AI deployment. Tier 1 covers internal productivity, Tier 2 covers investor / external-facing with approval, and Tier 3 covers regulated / financial deployments. Captures per-tier guard-rails, approval gates, audit obligations, and tier-promotion criteria.
+
+> This artefact is internal ArcKit synthesis on the federal three-tier model — no single public regulatory anchor exists. The underlying obligations come from the UAE AI Charter and PDPL.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | AI use cases and scope |
+| Architecture (`ARC-<id>-ARCH-v1.0.md`) | Model placement and inference path |
+| Security NFRs (`ARC-<id>-NFR-SEC-v1.0.md`) | Confidentiality and integrity requirements |
+| AI Charter assessment (`ARC-<id>-AICH-v*.md`) | Charter posture per use case |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-ai-autonomy-tier <project ID or AI system description>
+```
+
+Output: `projects/<id>/ARC-<id>-AUTI-v1.0.md`
+
+---
+
+## The Three Tiers
+
+| Tier | Use case | Posture |
+|------|----------|---------|
+| Tier 1 | Internal productivity (drafting, summarisation, internal copilots) | Lighter guard-rails, low-blast-radius decisions, log + review |
+| Tier 2 | Investor / external-facing with approval (citizen-facing assistants, decision-support) | Approval gates per externally-visible output, full audit |
+| Tier 3 | Regulated / financial (consequential decisions, regulated transactions) | Pre-deployment assurance, in-loop human, real-time audit, regulator notification |
+
+---
+
+## Posture Structure
+
+| Section | Contents |
+|---------|----------|
+| AI Use-Case Inventory | Per use case: tier, owner, decision class, blast radius |
+| Per-Tier Guard-Rail Matrix | Controls applied at each tier (input, model, output, monitoring) |
+| Approval Gates per Tier | Who approves what, when, and on what evidence |
+| Audit Obligations per Tier | Logging, retention, regulator notification cadence |
+| Tier-Promotion Criteria | Conditions to graduate a use case from Tier 1 → 2 → 3 |
+| External References | UAE AI Charter and PDPL citations |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Charter | 12-principle assessment | `/arckit:uae-ai-charter` |
+| Tier posture | Per-tier guard-rails + promotion criteria | `/arckit:uae-ai-autonomy-tier` |
+| Decisions | Tier-promotion is architecturally significant | `/arckit:adr` |
+| Risk | Per-tier residual risks | `/arckit:risk` |
+
+---
+
+## Review Checklist
+
+- Every AI use case in scope assigned to a tier with documented rationale.
+- Guard-rails differ meaningfully across tiers (no one-size-fits-all).
+- Approval gates name the role (not just "the team").
+- Audit retention windows stated per tier.
+- Tier-promotion criteria are objective and measurable.
+- Tier promotions captured as ADRs.
+- Per-tier residual risks fed to the project risk register.
+
+---
+
+## Key Notes
+
+- **Central Bank AI guidance** `[NEEDS VERIFICATION]`: The exact citation for UAE Central Bank AI guidance for Tier 3 regulated/financial workloads, and the boundary with Securities and Commodities Authority (SCA) guidance for capital-markets entities, is not yet pinned down — confirm sector-regulator obligations before publication. See `uae-overlay-maintenance.md` gap #5.
+- **No single regulatory anchor**: The three-tier model is an ArcKit synthesis. Run alongside `/arckit:uae-ai-charter` for the regulatory grounding.
+- **Cabinet 50% mandate**: Federal entities pursuing the 23 April 2026 agentic-AI mandate should keep tier-promotion criteria pre-published — the regulator may request them.
+- **Run after charter**: Charter posture is an input — run `/arckit:uae-ai-charter` first.
+- **Community-contributed**: Output should be reviewed by qualified AI ethics / federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-ai-charter.md

@@ -0,0 +1,89 @@
+# UAE Charter for AI Compliance Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-ai-charter` generates a UAE Charter for the Development and Use of AI compliance assessment for a federal entity AI system. Maps the system against the 12 Charter principles and produces a bias / fairness assessment plus a human-in-the-loop design.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | AI system purpose, users, decisions made |
+| Architecture (`ARC-<id>-ARCH-v1.0.md`) | Model placement, data flow, inference path |
+| Security NFRs (`ARC-<id>-NFR-SEC-v1.0.md`) | Confidentiality and integrity requirements |
+| DPIA / fairness / bias artefacts (if present) | Existing privacy and bias controls |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-ai-charter <project ID or AI system description>
+```
+
+Output: `projects/<id>/ARC-<id>-AICH-v1.0.md`
+
+---
+
+## The 12 Charter Principles
+
+| # | Principle |
+|---|-----------|
+| 1 | Human-machine ties |
+| 2 | Safety |
+| 3 | Bias mitigation |
+| 4 | Data privacy |
+| 5 | Transparency |
+| 6 | Human oversight |
+| 7 | Governance and accountability |
+| 8 | Technological excellence |
+| 9 | Human commitment |
+| 10 | Peaceful coexistence |
+| 11 | Inclusive access |
+| 12 | Lawful compliance |
+
+---
+
+## Assessment Structure
+
+| Section | Contents |
+|---------|----------|
+| AI System Inventory | Purpose, scope, decision class, autonomy posture |
+| 12-Principle Assessment | Per-principle compliance posture, evidence, gaps |
+| Bias & Fairness Assessment | Protected groups, fairness metrics, mitigations |
+| Human-in-the-Loop Design | Where humans intervene, escalation triggers, override rights |
+| External References | UAE AI Charter citations |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Discovery | AI system definition | `/arckit:requirements` |
+| Privacy | PDPL baseline | `/arckit:uae-pdpl` |
+| Charter | 12-principle assessment | `/arckit:uae-ai-charter` |
+| Autonomy | Per-tier guard-rails | `/arckit:uae-ai-autonomy-tier` |
+| Risk | Charter gaps into risk register | `/arckit:risk` |
+
+---
+
+## Review Checklist
+
+- All 12 principles assessed (no skipped rows).
+- Bias and fairness metrics defined and measurable.
+- Protected groups identified for the deployment context.
+- Human-in-the-loop intervention points are specific (which decisions, by whom, when).
+- Charter gaps surfaced to the project risk register.
+- Charter posture handed off to `/arckit:uae-ai-autonomy-tier` for guard-rail design.
+
+---
+
+## Key Notes
+
+- **Sector regulation**: For Central Bank-regulated workloads the Charter is a floor — the UAE Central Bank AI guidance is flagged as `[NEEDS VERIFICATION]` in the overlay maintenance log.
+- **Run order**: Run before `/arckit:uae-ai-autonomy-tier` so the Charter posture informs the tier design.
+- **Cross-jurisdiction projects**: For systems also touching the EU, run alongside `/arckit:eu-ai-act`.
+- **Community-contributed**: Output should be reviewed by qualified AI ethics / federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-classification.md

@@ -0,0 +1,73 @@
+# UAE Smart Data Classification Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-classification` generates a UAE Smart Data Classification Register, mapping every dataset in scope to one of `Open`, `Shared`, `Confidential`, `Secret`, or `Top Secret` with handling rules and a declassification schedule. Anchored on the UAE Smart Data Framework.
+
+This is the **upstream artefact** for the UAE federal overlay — most other UAE commands consume it.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Architecture principles (`ARC-000-PRIN-*.md`) | Federal principles applied to classification |
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Datasets in scope of the service |
+| Data model (`ARC-<id>-DMOD-v1.0.md`) | Per-entity sensitivity inputs |
+| `governance_framework: UAE Federal` and `classification_scheme: UAE Smart Data` user-config |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-classification <project ID or service name>
+```
+
+Output: `projects/<id>/ARC-<id>-CLAS-v1.0.md`
+
+---
+
+## Assessment Structure
+
+| Section | Contents |
+|---------|----------|
+| Classification Levels Used | Open / Shared / Confidential / Secret / Top Secret with anchor definitions |
+| Dataset Register | Per-dataset row with classification, owner, source, and rationale |
+| Handling Rules per Level | Storage, transit, access, retention, declassification |
+| Cross-Reference Index | Links from dataset → data model entity, requirements, residency rule |
+| External References | Smart Data Framework citations |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Discovery | Define service and datasets | `/arckit:requirements`, `/arckit:data-model` |
+| Classification | Map datasets to Smart Data ladder | `/arckit:uae-classification` |
+| Residency | Validate per-classification residency | `/arckit:uae-cloud-residency` |
+| Privacy | Map PDPL lawful basis to classified data | `/arckit:uae-pdpl` |
+| Sharing | Per-share sensitivity controls | `/arckit:uae-data-sharing` |
+
+---
+
+## Review Checklist
+
+- Every dataset in the service appears in the Dataset Register.
+- Each classification has a documented rationale (not "default to Confidential").
+- Handling rules cover storage, transit, access, retention, and declassification.
+- Cross-references back to data model entities resolve.
+- Confidential and above flagged for sovereign-cloud residency.
+- Owner named for every dataset (no "TBD").
+
+---
+
+## Key Notes
+
+- **Smart Data level names** `[NEEDS VERIFICATION]`: The overlay uses `Open / Shared / Confidential / Secret / Top Secret` based on the most recent TDRA guidance but these names have not been confirmed in a single authoritative source — verify against the entity's local Data Office guidance before publication. See `uae-overlay-maintenance.md` gap #2.
+- **Upstream artefact**: `uae-cloud-residency`, `uae-pdpl`, and `uae-data-sharing` all depend on this register being in place.
+- **userConfig must be set**: Without `governance_framework: UAE Federal` and `classification_scheme: UAE Smart Data`, the Document Control header will not render the UAE ladder.
+- **Migration**: To switch an existing UK-classified project, run `arckit migrate-classification --root projects --apply` (see `uae-overlay.md`).
+- **Community-contributed**: Output should be reviewed by qualified DPO / federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-cloud-residency.md

@@ -0,0 +1,84 @@
+# UAE Sovereign Cloud Residency Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-cloud-residency` assesses sovereign cloud residency under the UAE National Cloud Security Policy v2. Validates per-classification residency, names approved CSP options, and captures the shared-responsibility matrix and exit / portability plan.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Smart Data Classification Register (`ARC-<id>-CLAS-v*.md`) | **Required** — drives residency rules per dataset |
+| Architecture (`ARC-<id>-ARCH-v1.0.md`) | Workload topology and components |
+| IAS Statement of Applicability (`ARC-<id>-IAS-v*.md`) | T-family technical controls constrain CSP choice |
+
+> **Run after**: `/arckit:uae-classification` — the command halts if the classification register is missing.
+
+---
+
+## Command
+
+```bash
+/arckit:uae-cloud-residency <project ID or service name>
+```
+
+Output: `projects/<id>/ARC-<id>-CRES-v1.0.md`
+
+---
+
+## Assessment Structure
+
+| Section | Contents |
+|---------|----------|
+| Scope | Workloads in scope, CII status, classification levels involved |
+| Per-Dataset Residency Assessment | Required vs actual residency, gap, derogation if any |
+| CSP Due-Diligence Pack | Approved options compared against requirements |
+| Shared-Responsibility Matrix | Customer / CSP responsibility per IAS control |
+| Exit and Portability Plan | Lock-in mitigations, data egress, rebuild plan |
+| External References | National Cloud Security Policy v2 citations |
+
+---
+
+## Approved CSP Options
+
+| Provider | Region(s) | Sovereign posture |
+|----------|-----------|-------------------|
+| Core42 / G42 Sovereign | UAE | Federal sovereign cloud |
+| Microsoft Azure | UAE North, UAE Central | Hyperscaler with UAE residency |
+| TDRA FedNet | UAE | Federal government network |
+| e& Sovereign Launchpad on AWS | UAE | Sovereign overlay on AWS |
+
+> AWS me-south-1 acceptability under the Cloud Security Policy is flagged as `[NEEDS VERIFICATION]` in the overlay maintenance log — confirm before relying on AWS-only options.
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Classification | Smart Data ladder per dataset | `/arckit:uae-classification` |
+| Residency | CSP / region selection + SR matrix | `/arckit:uae-cloud-residency` |
+| Decisions | Capture CSP and region as ADRs | `/arckit:adr` |
+| Security | Reconcile T-family gaps | `/arckit:uae-ias`, `/arckit:risk` |
+
+---
+
+## Review Checklist
+
+- Smart Data Classification Register exists and was the input.
+- Every Confidential-and-above dataset has UAE-resident hosting.
+- Derogations (if any) cite the National Cloud Security Policy clause.
+- Shared-responsibility matrix mapped to IAS controls (no orphans).
+- Exit / portability plan covers data extraction format and timeline.
+- Material decisions (CSP, region, derogations) captured as ADRs.
+
+---
+
+## Key Notes
+
+- **Hard prerequisite**: This command halts without `ARC-<id>-CLAS-v*.md`. Run `/arckit:uae-classification` first.
+- **CII workloads**: Tighter residency rules apply — confirm with the Cybersecurity Council.
+- **Decision capture**: CSP and region selection are architecturally significant — produce ADRs via `/arckit:adr`.
+- **Community-contributed**: Output should be reviewed by qualified federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-data-sharing.md

@@ -0,0 +1,84 @@
+# UAE Data Sharing Agreement Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-data-sharing` generates a Data Sharing Agreement under the UAE Government Services Data Sharing Policy ("collect once, use securely"). Captures the collect-once mapping, federation / API plan, and PDPL lawful basis per share.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Cross-entity flows in scope |
+| Integration spec (`ARC-<id>-INT-v1.0.md`) | Existing integration surface |
+| Data requirements (`ARC-<id>-DR-v1.0.md`) | Per-share data categories |
+| Data model (`ARC-<id>-DMOD-v1.0.md`) | Entity-level structure |
+| Smart Data Classification Register (`ARC-<id>-CLAS-v*.md`) | Per-share sensitivity |
+| PDPL assessment (`ARC-<id>-PDPL-v*.md`) | Lawful-basis register |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-data-sharing <project ID or service name>
+```
+
+Output: `projects/<id>/ARC-<id>-DSHR-v1.0.md`
+
+---
+
+## Agreement Structure
+
+| Section | Contents |
+|---------|----------|
+| Sharing Parties | Producing and consuming federal entities, roles, accountable owners |
+| Datasets Shared | Per-share fields, classification, frequency, volume |
+| Lawful Basis per Share | PDPL lawful basis (consent, contract, legal obligation, public interest, etc.) |
+| Federation / API Mechanism | API contract, message schema, transport, identity model |
+| Information-Security Safeguards | Encryption, access control, logging, IAS-control mapping |
+| Data-Subject Rights Implications | Cascade of rights through the share |
+| External References | Data Sharing Policy citations |
+
+---
+
+## "Collect Once, Use Securely" Levers
+
+| Lever | Example |
+|-------|---------|
+| Authoritative source | Consume from federal register instead of re-collecting |
+| Federated query | Query at the edge instead of bulk copy |
+| Event-driven sync | Subscribe to changes only |
+| Tokenisation | Share opaque tokens instead of raw PII |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Privacy | PDPL baseline + lawful basis | `/arckit:uae-pdpl` |
+| Classification | Per-dataset Smart Data tags | `/arckit:uae-classification` |
+| Sharing | Data Sharing Agreement | `/arckit:uae-data-sharing` |
+| Integration | Federation / API contracts | `/arckit:integration` |
+
+---
+
+## Review Checklist
+
+- Every share names producing and consuming entities with accountable owners.
+- Lawful basis stated per share — reconciled to the PDPL lawful-basis register.
+- Federation / API contract specified (no "TBD" transport).
+- Security safeguards mapped to IAS controls.
+- Data-subject rights cascade documented (e.g. erasure across consumers).
+- "Collect once" justification — share is preferred over re-collection.
+
+---
+
+## Key Notes
+
+- **Run after PDPL and classification**: This command consumes both — gaps are flagged when prerequisites are missing.
+- **Tokenisation default**: Where Confidential or above must leave the producing entity, prefer tokenised exchange over raw payload.
+- **Cascading rights**: Erasure and rectification must propagate to consumers — design the cascade explicitly.
+- **Community-contributed**: Output should be reviewed by qualified DPO / federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-digital-records.md

@@ -0,0 +1,71 @@
+# UAE Digital Records Plan Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-digital-records` generates a Digital Records Plan under the UAE Government Services Digital Records Policy. Captures the source-of-truth register per service, retention schedule, records-as-official-source designation, and lifecycle / disposal procedures.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Service scope and record-producing flows |
+| Data requirements (`ARC-<id>-DR-v1.0.md`) | Record categories collected |
+| Data model (`ARC-<id>-DMOD-v1.0.md`) | Entity-level ownership inputs |
+| Architecture (`ARC-<id>-ARCH-v1.0.md`) | Storage and lifecycle components |
+| Smart Data Classification Register (`ARC-<id>-CLAS-v*.md`) | Sensitivity → retention rules |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-digital-records <project ID or service name>
+```
+
+Output: `projects/<id>/ARC-<id>-DREC-v1.0.md`
+
+---
+
+## Plan Structure
+
+| Section | Contents |
+|---------|----------|
+| Source-of-Truth Register | Per-record-type owner, system, and authoritative store |
+| Retention Schedule | Retention period, trigger, and disposal action per record type |
+| Records-as-Official-Source Designation | Which records are the federal source of truth |
+| Records Lifecycle | Creation → active → semi-active → disposal flow |
+| Audit & Disposal Procedures | Audit trail, witness, evidence retention |
+| External References | Digital Records Policy citations |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Inventory | Records produced and consumed | `/arckit:requirements`, `/arckit:data-model` |
+| Records | Source-of-truth + retention | `/arckit:uae-digital-records` |
+| Sharing | Official-source feeds downstream shares | `/arckit:uae-data-sharing` |
+| Compliance | PDPL retention reconciliation | `/arckit:uae-pdpl` |
+
+---
+
+## Review Checklist
+
+- Every record type has a single named source of truth.
+- Retention period stated for every record type (no "indefinite" without justification).
+- Records-as-official-source designation explicit per category.
+- Disposal procedure has audit trail and witness role.
+- Source-of-truth designations reconcile with data model entity ownership.
+- Retention reconciles with PDPL minimisation.
+
+---
+
+## Key Notes
+
+- **Ownership ambiguity**: Cabinet Affairs vs National Archives ownership of the Digital Records Policy is flagged as `[NEEDS VERIFICATION]` in the overlay maintenance log — confirm the current authority before publication.
+- **Source-of-truth conflict**: If multiple systems claim the same record category, this command surfaces the conflict — resolve via ADR before sign-off.
+- **Run order**: Best after data model is stable so entity ownership inputs are available.
+- **Community-contributed**: Output should be reviewed by qualified records-management and federal compliance counsel before reliance.